> Our package managers operate entirely on trust

Cannot agree with this oversimplification.

Exists community. Yes, every human have his own motives, but many live in countries with effective law enforcement, and many people obey Western Values.

Also important, software is a chain with many parts, some parts of one chain could make really large disruptions, some are less significant.

So overall, real formula includes trust, humanity values, laws, government effectiveness and inertia of this chain.